Detections
Analytics

5.3.3.2.7 Ensure password quality is enforced for the root user

Information

If the pwquality enforce_for_root option is enabled, the module will return error on failed check even if the user changing the password is root.

This option is off by default which means that just the message about the failed check is printed but root can change the password anyway.

By default the pam_pwquality checks are not enforced when the root user sets a password: a failed quality check produces only a warning and the password is still accepted. Because the root account is the highest-value target on the system, allowing its password to be set without meeting the quality requirements applied to every other account leaves a significant gap. Enforcing password quality for root closes that gap.

Solution

Edit or add the following line in a *.conf file in /etc/security/pwquality.conf.d or in /etc/security/pwquality.conf :

Example:

# printf '%s\n' "" "enforce_for_root" >> /etc/security/pwquality.conf.d/50-pwroot.conf

See Also

https://workbench.cisecurity.org/benchmarks/27892

Item Details

Category: IDENTIFICATION AND AUTHENTICATION

References: 800-53|IA-5, 800-53|IA-5(1), CSCv7|4.4

Plugin: Unix

Control ID: 4ed7392db5427bed509944802064b494bd345ac3044342b56217ece8c7bba2ee